Researchers at cybersecurity firm Kaspersky Lab say that ASUS, one of the world’s largest computer makers, was used to unwittingly install a malicious backdoor on thousands of its customers’ computers last year after attackers compromised a server for the company’s live software update tool. The malicious file was signed with legitimate ASUS digital certificates to make it appear to be an authentic software update from the company, Kaspersky Lab says.

ASUS, a multi-billion dollar computer hardware company based in Taiwan that manufactures desktop computers, laptops, mobile phones, smart home systems, and other electronics, was pushing the backdoor to customers for at least five months last year before it was discovered, according to new research from the Moscow-based security firm.

The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server, although the attackers appear to have been targeting only about 600 of those systems. The malware searched for targeted systems through their unique MAC addresses. Once on a system, if it found one of these targeted addresses, the malware reached out to a command-and-control server the attackers operated, which then installed additional malware on those machines.

Kaspersky Lab said it uncovered the attack in January after adding a new supply-chain detection technology to its scanning tool to catch anomalous code fragments hidden in legitimate code or catch code that is hijacking normal operations on a machine. The company plans to release a full technical paper and presentation about the ASUS attack, which it has dubbed ShadowHammer, next month at its Security Analyst Summit in Singapore. In the meantime, Kaspersky has published some of the technical details on its website.

“We saw the updates come down from the Live Update ASUS server. They were trojanized, or malicious updates, and they were signed by ASUS."

The issue highlights the growing threat from so-called supply-chain attacks, where malicious software or components get installed on systems as they’re manufactured or assembled, or afterward via trusted vendor channels. Last year the US launched a supply chain task force to examine the issue after a number of supply-chain attacks were uncovered in recent years. Although most attention on supply-chain attacks focuses on the potential for malicious implants to be added to hardware or software during manufacturing, vendor software updates are an ideal way for attackers to deliver malware to systems after they’re sold, because customers trust vendor updates, especially if they’re signed with a vendor’s legitimate digital certificate.

“This attack shows that the trust model we are using based on known vendor names and validation of digital signatures cannot guarantee that you are safe from malware,” said Vitaly Kamluk, Asia-Pacific director of Kaspersky Lab’s Global Research and Analysis Team who led the research. He noted that ASUS denied to Kaspersky that its server was compromised and that the malware came from its network when the researchers contacted the company in January. But the download path for the malware samples Kaspersky collected leads directly back to the ASUS server, Kamluk said.

Motherboard sent ASUS a list of the claims made by Kaspersky in three separate emails on Thursday but has not heard back from the company.

Read more: What Is a 'Supply Chain Attack?'

But the US-based security firm Symantec confirmed the Kaspersky findings on Friday after being asked by Motherboard to see if any of its customers also received the malicious download. The company is still investigating the matter but said in a phone call that at least 13,000 computers belonging to Symantec customers were infected with the malicious software update from ASUS last year.

“We saw the updates come down from the Live Update ASUS server. They were trojanized, or malicious updates, and they were signed by ASUS,” said Liam O’Murchu, director of development for the Security Technology and Response group at Symantec.

This is not the first time attackers have used trusted software updates to infect systems. The infamous Flame spy tool, developed by some of the same attackers behind Stuxnet, was the first known attack to trick users in this way by hijacking the Microsoft Windows updating tool on machines to infect computers. Flame, discovered in 2012, was signed with an unauthorized Microsoft certificate that attackers tricked Microsoft’s system into issuing to them. The attackers in that case did not actually compromise Microsoft’s update server to deliver Flame. Instead, they were able to redirect the software update tool on the machines of targeted customers so that they contacted a malicious server the attackers controlled instead of the legitimate Microsoft update server.

Two different attacks discovered in 2017 also compromised trusted software updates. One involved the computer security cleanup tool known as CCleaner that was delivering malware to customers via a software update. More than 2 million customers received that malicious update before it was discovered. The other incident involved the infamous notPetya attack that began in Ukraine and infected machines via a malicious update to an accounting software package.

Costin Raiu, company-wide director of Kaspersky’s Global Research and Analysis Team, said the ASUS attack is different from these others. “I’d say this attack stands out from previous ones while being one level up in complexity and stealthiness. The filtering of targets in a surgical manner by their MAC addresses is one of the reasons it stayed undetected for so long. If you are not a target, the malware is virtually silent,” he told Motherboard.

But even if silent on non-targeted systems, the malware still gave the attackers a backdoor into every infected ASUS system.

Tony Sager, senior vice president at the Center for Internet Security who did defensive vulnerability analysis for the NSA for years, said the method the attackers chose to target specific computers is odd.

“Supply chain attacks are in the ‘big deal’ category and are a sign of someone who is careful about this and has done some planning,” he told Motherboard in a phone call. “But putting something out that hits tens of thousands of targets when you’re really going only after a few is really going after something with a hammer.”

Kaspersky researchers first detected the malware on a customer’s machine on January 29. After they created a signature to find the malicious update file on other customer systems, they discovered that more than 57,000 Kaspersky customers had been infected with it. That victim toll only accounts for Kaspersky customers, however. Kamluk said the real number is likely in the hundreds of thousands.

Most of the infected machines belonging to Kaspersky customers (about 18 percent) were in Russia, followed by fewer numbers in Germany and France. Only about 5 percent of infected Kaspersky customers were in the United States. Symantec’s O’Murchu said that about 15 percent of the 13,000 machines belonging to his company’s infected customers were in the U.S.

Kamluk said Kaspersky notified ASUS of the problem on January 31, and a Kaspersky employee met with ASUS in person on February 14. But he said the company has been largely unresponsive since then and has not notified ASUS customers about the issue.

The attackers used two different ASUS digital certificates to sign their malware. The first expired in mid-2018, so the attackers then switched to a second legitimate ASUS certificate to sign their malware after this.

Kamluk said ASUS continued to use one of the compromised certificates to sign its own files for at least a month after Kaspersky notified the company of the problem, though it has since stopped. But Kamluk said ASUS has still not invalidated the two compromised certificates, which means the attackers or anyone else with access to the un-expired certificate could still sign malicious files with it, and machines would view those files as legitimate ASUS files.

This wouldn't be the first time ASUS was accused of compromising the security of its customers. In 2016, the company was charged by the Federal Trade Commission with misrepresentation and unfair security practices over multiple vulnerabilities in its routers, cloud back-up storage and firmware update tool that would have allowed attackers to gain access to customer files and router log-in credentials, among other things. The FTC claimed ASUS knew about those vulnerabilities for at least a year before fixing them and notifying customers, putting nearly a million US router owners at risk of attack. ASUS settled the case by agreeing to establish and maintain a comprehensive security program that would be subject to independent audit for 20 years.

The ASUS live update tool that delivered malware to customers last year is installed at the factory on ASUS laptops and other devices. When users enable it, the tool contacts the ASUS update server periodically to see if any firmware or other software updates are available.

“They wanted to get into very specific targets and they already knew in advance their network card MAC address, which is quite interesting.”

The malicious file pushed to customer machines through the tool was called setup.exe, and purported to be an update to the update tool itself. It was actually a three-year-old ASUS update file from 2015 that the attackers injected with malicious code before signing it with a legitimate ASUS certificate. The attackers appear to have pushed it out to users between June and November 2018, according to Kaspersky Lab. Kamluk said the use of an old binary with a current certificate suggests the attackers had access to the server where ASUS signs its files but not the actual build server where it compiles new ones. Because the attackers used the same ASUS binary each time, it suggests they didn’t have access to the whole ASUS infrastructure, just part of the signing infrastructure, Kamluk notes. Legitimate ASUS software updates still got pushed to customers during the period the malware was being pushed out, but these legitimate updates were signed with a different certificate that used enhanced validation protection, Kamluk said, making it more difficult to spoof.

The Kaspersky researchers collected more than 200 samples of the malicious file from customer machines, which is how they discovered the attack was multi-staged and targeted.

Buried in those malicious samples were hard-coded MD5 hash values that turned out to be unique MAC addresses for network adapter cards. MD5 is an algorithm that creates a cryptographic representation or value for data that is run through the algorithm. Every network card has a unique ID or address assigned by the manufacturer of the card, and the attackers created a hash of each MAC address it was seeking before hard-coding those hashes into their malicious file, to make it more difficult to see what the malware was doing. The malware had 600 unique MAC addresses it was seeking, though the actual number of targeted customers may be larger than this. Kaspersky can only see the MAC addresses that were hard-coded into the particular malware samples found on its customers’ machines.

Image: Shutterstock

The Kaspersky researchers were able to crack most of the hashes they found to determine the MAC addresses, which helped them identify what network cards the victims had installed on their machines, but not the victims themselves. Any time the malware infected a machine, it collected the MAC address from that machine’s network card, hashed it, and compared that hash against the ones hard-coded in the malware. If it found a match to any of the 600 targeted addresses, the malware reached out to asushotfix.com, a site masquerading as a legitimate ASUS site, to fetch a second-stage backdoor that it downloaded to that system. Because only a small number of machines contacted the command-and-control server, this helped the malware stay under the radar.

“They were not trying to target as many users as possible,” said Kamluk. “They wanted to get into very specific targets and they already knew in advance their network card MAC address, which is quite interesting.”

Symantec’s O’Murchu said he’s not sure yet if any of his company’s customers were among those whose MAC addresses were on the target list and received the second-stage backdoor.

The command-and-control server that delivered the second-stage backdoor was registered May 3 last year but was shut down in November before Kaspersky discovered the attack. Because of this, the researchers were unable to obtain a copy of the second-stage backdoor pushed out to victims or identify victim machines that had contacted that server. Kaspersky believes at least one of its customers in Russia got infected with the second-stage backdoor when his machine contacted the command-and-control server on October 29 last year, but Raiu says the company doesn’t know the identity of the machine’s owner in order to contact him and investigate further.

There were early hints that a signed and malicious ASUS update was being pushed to users in June 2018, when a number of people posted comments in a Reddit forum about a suspicious ASUS alert that popped up on their machines for a “critical” update. “ASUS strongly recommends that you install these updates now,” the alert warned.

In a post titled “ASUSFourceUpdater.exe is trying to do some mystery update, but it won't say what,” a user named GreyWolfx wrote, “I got an update popup from a .exe that I had never seen before today….I’m just curious if anyone knows what this update would possibly be for?”

When he and other users clicked on their ASUS updater tool to get information about the update, the tool showed no recent updates had been issued from ASUS. But because the file was digitally signed with an ASUS certificate and because scans of the file on the VirusTotal web site indicated it was not malicious, many accepted the update as legitimate and downloaded it to their machines. VirusTotal is a site that aggregates dozens of antivirus programs; users can upload suspicious files to the site to see if any of the tools detect it as malicious.

“I uploaded the executable [to VirusTotal] and it comes back as a validly signed file without issue,” one user wrote. “The spelling of 'force' and the empty details window are indeed odd, but I noticed odd grammar errors in other ASUS software installed on this system, so it's not a smoking gun by itself,” he noted.

Kamluk and Raiu said this may not be the first time the ShadowHammer attackers have struck. They said they found similarities between the ASUS attack and ones previously conducted by a group dubbed ShadowPad by Kaspersky. ShadowPad targeted a Korean company that makes enterprise software for administering servers; the same group was also linked to the CCleaner attack. Although millions of machines were infected with the malicious CCleaner software update, only a subset of these got targeted with a second stage backdoor, similar to the ASUS victims. Notably, ASUS systems themselves were on the targeted CCleaner list.

The Kaspersky researchers believe the ShadowHammer attackers were behind the ShadowPad and CCleaner attacks and obtained access to the ASUS servers through the latter attack.

“ASUS was one of the primary targets of the CCleaner attack,” Raiu said. “One of the possibilities we are taking into account is that’s how they intially got into the ASUS network and then later through persistence they managed to leverage the access … to launch the ASUS attack.”

Listen to CYBER, Motherboard’s new weekly podcast about hacking and cybersecurity.

Last week, hackers forced a well-known security journalist to take down his site after hitting him for more than two days with an unprecedented flood of traffic.

That cyberattack was powered by something the internet had never seen before: an army made of more than one million hacked Internet of Things devices.

The hackers, whose identity is still unknown at this point, used not one, but two networks—commonly referred to as "botnets" in hacking lingo—made of around 980,000 and 500,000 hacked devices, mostly internet-connected cameras, according to Level 3 Communications, one of the world's largest internet backbone providers. The attackers used all those cameras and other unsecured online devices to connect to the journalists' website, pummeling the site with requests in an attempt to make it collapse.

These botnets were allegedly behind the staggering and crippling distributed denial of service attack (DDoS) to KrebsOnSecurity.com, the website of the independent journalist Brian Krebs, who has a long history of exposing DDoS-wielding cybercriminals. The digital assault surpassed 660 Gbps of traffic, making it one of the largest recorded in history in terms of volume.

Read more: The Internet of Things Will Turn Large-Scale Hacks into Real World Disasters

Level 3 has been tracking one of the botnets used against Krebs for about a month, and last week the company saw that hackers used that botnet, along with another smaller one, against Krebs.

"They're still using it against Krebs," Dale Drew, chief security officer at Level 3 Communications, told Motherboard on Wednesday. "As of this morning."

Security researchers and internet defenders are still looking into the attacks and trying to track who's behind them, but people who've been working to protect websites against large denial of service (DDoS) attacks such as this one all agree this was was unprecedented both because of its shocking size and because of the use of what could be called a Botnet of Things.

"This was the biggest attack we've ever seen," Martin McKeay, the senior security advocate for Akamai, the company that was providing protection to Krebs when the attack started last week, told me.

At this point, however, it's unclear if the attackers used the full power of the two botnets or just a portion of it. Drew said that the hackers used around 1.2 million nodes of the total 1.5 million-strong botnets against Krebs. But McKeay, who declined to go into the details of the attacks citing company policies toward customers, said that "nothing" Akamai saw suggests those numbers are "possible." (Akamai, which was providing Krebs with pro-bono protection, decided to let him go when it became too costly to hold off the barrage of traffic.)

"This was the biggest attack we've ever seen."

The attack against Krebs, along with other similar attacks launched across the internet in the last few weeks, might signal the beginning of a new era where criminals use easily hackable Internet of Things devices to censor websites or launch malware attacks—a nightmare scenario that some saw as inevitable.

"We're starting to see the first consequences of these poorly secured devices and the damage they can do when they are compromised," said Matthew Prince, the founder of Cloudflare, a company that offers DDoS protection. "I don't know that many other organizations have seen the full capabilities of this botnet pointed at them. But of course it's inevitable. Whenever the attack on Krebs is over, anyone else on the internet is vulnerable to having this type of attack pointed at them."

The DDoS attack on Krebs was unusual not just because of the sheer size and volume, but because most of the traffic used in was direct. In last few years, hackers have launched large DDoS attacks by tricking faulty servers into boosting their malicious traffic. In these attacks, the servers generate multiple response packet for each packet sent in. They are known as amplification or reflection attacks and essentially give hackers more firepower than they actually have.

In this case, however, whoever is behind the attack really had all that firepower.

"The attackers were not just sending garbage traffic that was easy to tell it didn't belong there," Prince said, "but they were sending relatively legitimate requests."

HOW THE INTERNET OF THINGS ZOMBIE ARMY WAS FORMED

According to Level 3, the larger botnet used against Krebs is made mostly of internet-connected security cameras made by DAHUA Technology, a Chinese manufacturer, with a subsidiary in California, of cameras and DVRs. Level 3 had already revealed the existence of the 1 million-strong botnet in late August.

Drew explained that the hackers found a vulnerability, which affects most of DAHUA's cameras, that allows anyone to take full control of the devices' underlying Linux operating system just by typing a random username with too many characters.

The hackers then planted malware on the devices to turn them into bots and use them for both DDoS attacks as well as for extortion campaigns using ransomware., Drew said. The malware targets specifically Linux devices and is part of a family that previously went by the names Lizkebab, BASHLITE, Torlus and gafgyt, according to Level 3 and others who have been investigating the attacks.

"These cameras are going to be exposed for quite some time."

The hackers used the latest iteration of that malware family, now called Mirai, according to Marshal Webb, the chief technology officer of BackConnect, an anti-DDoS firm.

Mirai appears to be spreading fast. A security researcher put online six virtual machines designed to look like ADSL routers running Linux operating systems just like the ones targeted by Mirai—in other words, a set of honeypots.

It took only an average of 15 minutes for these to get hit with Mirai malware, the researcher, who asked to be referred to as "Jack B." to protect his real identity, told me in an online chat. (If you didn't just say "holy shit," you probably should have.)

DAHUA did not respond to a request for comment. But Drew said that the company has been notified of the vulnerability and is working on a fix. The problem, he said, is that there's no way for DAHUA to remotely fix the flaw, and customers' will have to download new firmware and update the cameras themselves.

"These cameras are going to be exposed for quite some time," Drew said.

The botnet is not just made of DAHUA devices though. Researchers I spoke to also listed other embedded devices such as home routers, and Linux servers.

WHODDUNIT?

The very nature of this kind of attack, whose bogus traffic comes from several sources, makes it hard to pinpoint and unmask who's really behind the keyboard.

In the last few weeks, whoever is behind the attack on Krebs appears to have used the same botnet or botnets in similar attacks against other targets, such as the official site of the Rio Olympics, which was hit with a DDoS clocking in at 540 Gbps, according to Arbor Networks.

That attack used a form of traffic designed to look like Generic Routing Encapsulation (GRE) data packets, an unusual choice of protocol for a DDoS attack. The hackers behind the Krebs attack, as the journalist himself reported, also used GRE traffic.

Also last week, French hosting provider OVH quietly reported of a series of large DDoS attacks, some recording as much as 900 Gbps and 1 Tbps.

OVH declined to comment, and at this point, it's unclear if the attacks on Krebs and OVH are connected.

Some circumstantial evidence seems to point in the direction of groups like Lizard Squad and PoodleCorp, who've made a name for themselves using DDoS attacks to disrupt mostly gaming platforms and websites in the past,

Mirai, the malware allegedly used to build the massive million-strong botnet, for one, is a successor of IoT-infecting malware used by Lizard Squad in the past. But anyone could be using the malware's new iterations.

During the attack last week, a hacker who goes by the name "BannedOffline" on Twitter hinted he was part of the attack in a series of tweets.

But the hacker said he was only one of many attackers.

"I'm not the only one who doesn't like [Krebs] or his site," BannedOffline told me in an online chat. "No one likes him lol. At least in the hacker community."

A hacker who goes by the name Cripthepoodle, and who claimed to be once part of PoodleCorp, said the group was behind the attack.

"They love causing as much as chaos as they can," Cripthepoodle told me.

Last week, when Krebs disclosed that his site was temporarily shutting down, PoodleCorp seemed to poke fun at him in a now-deleted tweet send by its semi-official Twitter account. Of course, this is most likely a jab at Krebs, who regularly reports and exposes hacktivist groups.

Whoever is behind these attacks, in any case, is likely being hunted not just by researchers, but also law enforcement. (The FBI declined to comment on whether the bureau is investigating these attacks.)

The attack on Krebs' website was so powerful, according to Prince and Level 3, that it congested some internet routes, spilling over the effects of the DDoS to some parts of the internet. While this might not have been noticed by people watching Netflix or checking their email, it was certainly noticed by internet service providers and likely the authorities.

"When you launch an attack which is large enough that it starts to impact internet infrastructure, it's not long before you get caught," Prince said.

Even if the hackers behind the attacks get caught, these massive DDoS attacks wielding infected Internet of Things could just be the first in a long series, as other criminals will see them as an inspiration.

"I'm certain that there are other smart 15-year-old kids rounding up botnets of CCTV cameras that they can compromise and control," Prince said.

Or, as Akamai's McKeay put it, this is "a bad sign for the internet."

Correction: a previous version of this article stated that DAHUA is an American company. In fact, it is a Chinese company, with a subsidiary in the US.

Get six of our favorite Motherboard stories every day by signing up for our newsletter.

In the summer of 2014, a little known boutique contractor from New Delhi, India, was trying to crack into the lucrative $5 billion a year market of outsourced government surveillance and hacking services.

To impress potential customers, the company, called Aglaya, outlined an impressive—and shady—series of offerings in a detailed 20-page brochure. The brochure, obtained by Motherboard, offers detailed insight into purveyors of surveillance and hacking tools who advertise their wares at industry and government-only conferences across the world.

The leaked brochure, which had never been published before, not only exposes Aglaya's questionable services, but offers a unique glimpse into the shadowy backroom dealings between hacking contractors, infosecurity middlemen, and governments around the world which are rushing to boost their surveillance and hacking capabilities as their targets go online.

Read more: The Hacking Team Defectors

The sales document also outlines how commonplace commercial spy tools have become. For €3,000 per license, the company offered Android and iOS spyware, much like the malware offered in the past by the likes of Hacking Team, FinFisher, and, more recently, the NSO Group, whose iPhone-hacking tool was just caught in the wild last week. For €250,000, the company claimed it could track any cell phone in the world.

These were standard services offered by a plethora of companies who often peddle their wares at ISS World, an annual series of conferences that are informally known as the "Wiretappers' Ball."

But Aglaya had much more to offer, according to its brochure. For eight to 12 weeks campaigns costing €2,500 per day, the company promised to "pollute" internet search results and social networks like Facebook and Twitter "to manipulate current events." For this service, which it labelled "Weaponized Information," Aglaya offered "infiltration," "ruse," and "sting" operations to "discredit a target" such as an "individual or company."

"[We] will continue to barrage information till it gains 'traction' & top 10 search results yield a desired results on ANY Search engine," the company boasted as an extra "benefit" of this service.

Aglaya also offered censorship-as-a-service, or Distributed Denial of Service (DDoS) attacks, for only €600 a day, using botnets to "send dummy traffic" to targets, taking them offline, according to the brochure. As part of this service, customers could buy an add-on to "create false criminal charges against Targets in their respective countries" for a more costly €1 million.

Also starting at €1 million, customers could purchase a "Cyber Warfare Service" to attack "manufacturing" plants, the "power grid," "critical network infrastructure," and even satellites and airplanes. Aglaya even claimed to sell unknown flaws, or zero-days, in Siemens industrial control systems for €2 million.

Some of Aglaya's offerings, according to experts who reviewed the document for Motherboard, are likely to be exaggerated or completely made-up. But the document shows that there are governments interested in these services, which means there will be companies willing to fill the gaps in the market and offer them.

"Some of this stuff is really, really, sketchy," Christopher Soghoian, the principal technologist at the American Civil Liberties Union, who has followed the booming market of surveillance tech vendors for years, told Motherboard. "When you're offering the ability to attack satellites and airplanes, this is not lawful intercept. This is basically 'whatever you want we'll try to do it.' These guys are clearly mercenaries, what's not clear is if they can deliver on their promises. This is not a company pretending that it's solely focusing on the lawful intercept market, this is outsourcing cyber operations."

Ankur Srivastava, the CEO and founder of Aglaya, did not deny that the brochure is legitimate, only saying this particular product sheet was passed on only to "one particular customer."

"These products are not on our web site, with our customers and nor do they represent the vision of our product portfolio," Srivastava said in an email. "This was a custom proposal for one customer only and was not pursued since the relationship did not come to fruition."

Srivastava added that he regretted attending ISS because Aglaya was never able to close a deal and sell its services. He also claimed that the company doesn't offer those kind of services anymore. (One of the organizers of ISS World did not respond to a request for comment, asking whether the conference vetted or condoned companies offering such services.)

"I would go the distance to aim to convince you that we are not a part of this market and unintentionally underwent a marketing event at the wrong trade-show," he added.

When asked a series of more detailed questions, however, Srivastava refused to elaborate, instead reiterating that Aglaya never did any business as a government hacking contractor and that attending ISS was "an exercise of time and money, albeit, in futility." He complained that his company's failure was likely due to the fact that it is not based "in the West," hypothesizing that most customers want "western" suppliers.

Asked for the identity of the potential customer who showed interest for these services, Srivastava said he did not know, claiming he only dealt with a reseller, an "agent" from South America who "claimed to have global connections" and "was interested in anything and everything."

The document itself doesn't offer any clues as to the country interested. But Latin American governments such as the ones in Mexico and Ecuador are known to have used Twitter bots and other tactics to launch disinformation campaigns online, much like the ones Aglaya was offering. Mexico, moreover, is a well-known big-spender when it comes to buying off-the-shelf spyware made by the likes of Hacking Team and FinFisher.

"I would go the distance to aim to convince you that we are not a part of this market."

Srivastava also dodged questions about his company's spyware products. But a source who used to work in the surveillance tech industry, who asked to remain anonymous to discuss sensitive issues, claimed to have seen a sample of Aglaya's malware in the wild.

"It was crap," the source said. "The code was full of references to Aglaya."

One of his customers was targeted with it at the end of last year, when he received a new phone via mail, under the pretense that he had won a contest that turned out to be made up, according to the source. As ridiculous as this might be, this is actually how Aglaya targeted victims, given that they couldn't admittedly get around Apple's security measures and jailbreak the device to infect it with malware.

This sloppy workaround was described in an article in the spyware trade publication Insider Surveillance.

"For installation, Aglaya iOS Backdoor requires an unattended phone and a passcode," the article read. "By 'unattended' we're hoping they mean 'idle,' not 'impounded.' Or that they're not expecting agents to sneak into the target's bedroom to plant the malware...or wait for him to divulge the password while talking in his sleep."

The anonymous source, in any case, said that there is certainly a market for the services offered by Aglaya, including the sketchier ones.

"I think it's credible that there is interest for these type of services at least in certain countries in the Middle East," the source said.

Another source, who also requested anonymity to speak freely, said that an Aglaya representative once claimed that his company had customers in the Middle East. The source also said that Aglaya's claims of having abandoned the surveillance tech business are "a lie," adding that he has seen an updated version of that brochure last year.

Aglaya might have some customers, but it's likely a small fish in the surveillance and hacking business. There are certainly many more companies, likely with better services and more customers, that we don't know about. We also might never know about them, unless they get caught because customers abuse their tools—as in the cases of NSO Group and Hacking Team—or their marketing materials leak online.

Often, these companies peddle both defensive and offensive services. Srivastava, after dodging most of my questions, offered to let Motherboard take a look at Aglaya's latest product, dubbed SpiderMonkey, a device that detects "Stingrays" or IMSI-catchers, the surveillance gizmos used by police and intelligence around the world to track and intercept cellphone data.

"Please do keep us in mind," he said, likely repeating a line that he told his unknown "one" customer two years ago.

Want more Motherboard in your life? Then sign up for our daily newsletter.

The Weakest Link is Motherboard's third annual theme week dedicated to the future of hacking and cybersecurity. Follow along.

Listen to Motherboard’s new hacking podcast, CYBER, here.

The following is an excerpted chapter from the Bruce Schneier's book, Click Here to Kill Everybody: Security and Survival in a Hyper-connected World.

There are two basic paradigms of security. The first comes from the real world of dangerous technologies: the world of automobiles, planes, pharmaceuticals, architecture and construction, and medical devices. It’s the traditional way we do design, and can be best summed up as “Get it right the first time.” This is the world of rigorous testing, of security certifications, and licensed engineers. At the extreme, it’s a slow and expensive process: think of all the safety testing Boeing conducts on its new aircraft, or any pharmaceutical company conducts before releasing a new drug in the market. It’s also the world of slow and expensive changes, because each change has to go through the same process.

We do this because the costs of getting it wrong are so great. We don’t want buildings collapsing on us, planes falling out of the sky, or thousands of people dying from a pharmaceutical’s side effects or drug interaction. And while we can’t eliminate all those risks completely, we can mitigate them by doing a lot of up- front work.

The alternative security paradigm comes from the fast- moving, freewheeling, highly complex, and heretofore largely benign world of software. Its motto is “Make sure your security is agile” or, in Facebook lingo, “Move fast and break things.” In this model, we try to make sure we can update our systems quickly when security vulnerabilities are discovered. We try to build systems that are survivable, that can recover from attack, that actually mitigate attacks, and that adapt to changing threats. But mostly we build systems that we can quickly and efficiently patch. We can argue how well we achieve these goals, but we accept the problems because the cost of getting it wrong isn’t that great.

There are undiscovered vulnerabilities in every piece of software.

In a world where we increasingly rely on internet-connected devices, these two paradigms are colliding. They’re colliding in your cars. They’re colliding in home appliances. They’re colliding in computerized medical devices. They’re colliding in home thermostats, computerized voting machines, and traffic control systems— and in our chemical plants, dams, and power plants. They’re colliding again and again, and the stakes are getting higher because failures can affect life and property.

Patching is something we all do all the time with our software— we usually call it “updating”— and it’s the primary mechanism we have to keep our systems secure. How it works (and doesn’t), and how it will fare in the future, is important to understand in order to fully appreciate the security challenges we face.

There are undiscovered vulnerabilities in every piece of software. They lie dormant for months and years, and new ones are discovered all the time by everyone from companies to governments to independent researchers to cybercriminals. We maintain security through (1) discoverers disclosing a found vulnerability to the software vendor and the public, (2) vendors quickly issuing a security patch to fix the vulnerability, and (3) users installing that patch.

It took us a long time to get here. In the early 1990s, researchers would disclose vulnerabilities to the vendors only. Vendors would respond by basically not doing anything, maybe getting around to fixing the vulnerabilities years later. Researchers then started publicly announcing that they had found a vulnerability, in an effort to get vendors to do something about it— only to have the vendors belittle them, declare their attacks “theoretical” and not worth worrying about, threaten them with legal action, and continue to not fix anything. The only solution that spurred vendors into action was for researchers to publish details about the vulnerability. Today, researchers give software vendors advance warning when they find a vulnerability, but then they publish the details. Publication has become the stick that motivates vendors to quickly release security patches, as well as the means for researchers to learn from each other and get credit for their work; this publication further improves security by giving other researchers both knowledge and incentive. If you hear the term “responsible disclosure,” it refers to this process.

Lots of researchers—from lone hackers to academic researchers to corporate engineers—find and responsibly disclose vulnerabilities. Companies offer bug bounties to hackers who bring vulnerabilities to them instead of publishing those vulnerabilities or using them to commit crimes. Google has an entire team, called Project Zero, devoted to finding vulnerabilities in commonly used software, both public- domain and proprietary. You can argue with the motivations of these researchers—many are in it for the publicity or competitive advantage—but not with the results. Despite the seemingly endless stream of vulnerabilities, any piece of software becomes more secure as they are found and patched.

It’s not happily ever after, though. There are several problems with the find-and-patch system. Let’s look at the situation in terms of the entire ecosystem—researching vulnerabilities, disclosing vulnerabilities to the manufacturer, writing and publishing patches, and installing patches— in reverse chronological order.

Installing patches: I remember those early years when users, especially corporate networks, were hesitant to install patches. Patches were often poorly tested, and far too often they broke more than they fixed. This was true for everyone who released software: operating system vendors, large software vendors, and so on. Things have changed over the years. The big operating system organizations—Microsoft, Apple, and Linux in particular—have become much better about testing their patches before releasing them. As people have become more comfortable with patches, they have become better about installing them more quickly and more often. At the same time, vendors are now making patches easier to install.

Still, not everyone patches their systems. The industry rule of thumb is that a quarter of us install patches on the day they’re issued, a quarter within the month, a quarter within the year, and a quarter never do. The patch rate is even lower for military, industrial, and healthcare systems because of how specialized the software is. It’s more likely that a patch will break some critical functionality.

People who are using pirated copies of software often can’t get updates. Some people just don’t want to be bothered. Others forget. Some people don’t patch because they’re tired of vendors slipping unwanted features and software into updates. Some IoT systems are just harder to update. How often do you update the software in your router, refrigerator, or microwave? Never is my guess. And no, they don’t update automatically.

Three 2017 examples illustrate the problem. Equifax was hacked because it didn’t install a patch for its Apache web server that had been available two months previously. The WannaCry malware was a worldwide scourge, but it only affected unpatched Windows systems. The Amnesia IoT botnet made use of a vulnerability in digital video recorders that had been disclosed and fixed a year earlier, but existing machines couldn’t be patched.

The situation is worse for the computers embedded in IoT devices. In a lot of systems—both low-cost and expensive—users have to manually download and install relevant patches. Often the patching process is tedious and complicated, and beyond the skill of the average user. Sometimes, ISPs have the ability to remotely patch things like routers and modems, but this is also rare. Even worse, many embedded devices don’t have any way to be patched. Right now, the only way for you to update the firmware in your hackable DVR is to throw it away and buy a new one.

At the low end of the market, the result is hundreds of millions of devices that have been sitting on the Internet, unpatched and insecure, for the last five to ten years. In 2010, a security researcher analyzed 30 home routers and was able to break into half of them, including some of the most popular and common brands. Things haven’t improved since then.

Hackers are starting to notice. The malware DNSChanger attacks home routers, as well as computers. In Brazil in 2012, 4.5 million DSL routers were compromised for purposes of financial fraud. In 2013, a Linux worm targeted routers, cameras, and other embedded devices. In 2016, the Mirai botnet used vulnerabilities in digital video recorders, webcams, and routers; it exploited such rookie security mistakes as devices having default passwords.

The difficulty of patching also plagues expensive IoT devices that you might expect to be better designed. In 2015, Chrysler recalled 1.4 million vehicles to patch a security vulnerability. The only way to patch them was for Chrysler to mail every car owner a USB drive to plug into a port on the vehicle’s dashboard. In 2017, Abbott Labs told 465,000 pacemaker patients that they had to go to an authorized clinic for a critical security update. At least the patients didn’t have to have their chests opened up.

This is likely to be a temporary problem, at least for more expensive devices. Industries that aren’t used to patching will learn how to do it. Companies selling expensive equipment with embedded computers will learn how to design their systems to be patched automatically. Compare Tesla to Chrysler: Tesla pushes updates and patches to cars automatically, and updates the systems overnight. Kindle does the same thing: owners have no control over the patching process, and usually have no idea that their devices have even been patched.

Writing and publishing patches: Vendors can be slow to release security patches. One 2016 survey found that about 20 percent of all vulnerabilities—and 7 percent of vulnerabilities in the “top 50 applications”—did not have a patch available the same day the vulnerability was disclosed. (To be fair, this is an improvement over previous years. In 2011, a third of all vulnerabilities did not have a patch available on the day of disclosure.) Even worse, only an additional 1 percent were patched within a month after disclosure, indicating that if a vendor doesn’t patch immediately, it’s not likely to get to it anytime soon. Android users, for example, often have to wait months after Google issues a patch before their handset manufacturers make that patch available to users. The result is that about half of all Android phones haven’t been patched in over a year.

Patches also aren’t as reliable as we would like them to be; they still occasionally break the systems they’re supposed to be fixing. In 2014, an iOS patch left some users unable to get a cell signal. In 2017, a flawed patch to Internet- enabled door locks by Lockstate bricked the devices, leaving users unable to lock or unlock their doors. In 2018, in response to the Spectre and Meltdown vulnerabilities in computer CPUs, Microsoft issued a patch to its operating system that bricked some computers. There are more examples.

If we turn to embedded systems and IoT devices, the situation is much more dire. Our computers and smartphones are as secure as they are because there are teams of security engineers dedicated to writing patches. The companies that make these devices can support such big teams because they make a huge amount of money, either directly or indirectly, from their software—and, in part, compete on its security. This isn’t true of embedded systems like digital video recorders or home routers. Those systems are sold at a much lower margin and in much smaller quantities, and are often designed by offshore third parties. Engineering teams assemble quickly to design the products, then disband or go build something else. Parts of the code might be old and out- of- date, reused again and again. There might not be any source code available, making it much harder to write patches. The companies involved simply don’t have the budget to make their products secure, and there’s no business case for them to do so.

We’re already seeing the effects of systems so old that the vendors stopped patching them, or went out of business altogether.

Even worse, no one has the incentive to patch the software once it’s been shipped. The chip manufacturer is busy shipping the next version of the chip, the device manufacturer is busy upgrading its product to work with this next chip, and the vendor with its name on the box is just a reseller. Maintaining the older chips and products isn’t a priority for anyone.

Even when manufacturers have the incentive, there’s a different problem. If there’s a security vulnerability in Microsoft operating systems, the company has to write a patch for each version it supports. Maintaining lots of different operating systems gets expensive, which is why Microsoft and Apple— and everyone else— support only the few most recent versions. If you’re using an older version of Windows or macOS, you won’t get security patches, because the companies aren’t creating them anymore.

This won’t work with more durable goods. We might buy a new DVR every 5 or 10 years, and a refrigerator every 25 years. We drive a car we buy today for a decade, sell it to someone else who drives it for another decade, and that person sells it to someone who ships it to a Third World country, where it’s resold yet again and driven for yet another decade or two. Go try to boot up a 1978 Commodore PET computer, or try to run that year’s VisiCalc, and see what happens; we simply don’t know how to maintain 40-year-old software.

Consider a car company. It might sell a dozen different types of cars with a dozen different software builds each year. Even assuming that the software gets updated only every two years and the company supports the cars for only two decades, the company needs to maintain the capability to update 20 to 30 different software versions. (For a company like Bosch that supplies automotive parts for many different manufacturers, the number would be more like 200.) The expense and warehouse size for the test vehicles and associated equipment would be enormous.

Alternatively, imagine if car companies announced that they would no longer support vehicles older than five, or ten, years. There would be serious environmental consequences.

We’re already seeing the effects of systems so old that the vendors stopped patching them, or went out of business altogether. Some of the organizations affected by WannaCry were still using Windows XP, an unpatchable 17-year-old operating system that Microsoft stopped supporting in 2014. About 140 million computers worldwide still run that operating system, including most ATMs. A popular shipboard satellite communications system once sold by Inmarsat Group is no longer patched, even though it contains critical security vulnerabilities. This is a big problem for industrial- control systems, because many of them run outdated software and operating systems, and upgrading them is prohibitively expensive because they’re very specialized. These systems can stay in operation for many years and often don’t have big IT budgets associated with them.

The current system of patching is going to be increasingly inadequate as computers become embedded in more and more things. The problem is that we have nothing better to replace it with.

Certification exacerbates the problem. Before everything became a computer, dangerous devices like cars, airplanes, and medical devices had to go through various levels of safety certification before they could be sold. A product, once certified, couldn’t be changed without having to be recertified. For an airplane, it can cost upwards of a million dollars and take a year to change one line of code. This made sense in the analog world, where products didn’t change much. But the whole point of patching is to enable products to change, and change quickly.

Disclosing vulnerabilities: Not everyone discloses security vulnerabilities when they find them; some hoard them for offensive purposes. Attackers use them to break into systems, and that’s the first time we learn of them. These are called “zero-day vulnerabilities,” and responsible vendors try to quickly patch them as well. Government agencies like the NSA, US Cyber Command, and their foreign equivalents also keep some vulnerabilities secret for their own present and future use. Every discovered but undisclosed vulnerability— even if it is kept by someone you trust— can be independently discovered and used against you.

Even researchers who want to disclose the vulnerabilities they discover sometimes find a chilly reception from the device manufacturers. Those new industries getting into the computer business—the coffeepot manufacturers and their ilk—don’t have experience with security researchers, responsible disclosure, and patching, and it shows. This lack of security expertise is critical. Software companies write software as their core competency. Refrigerator manufacturers, or refrigerator divisions of larger companies, have a different core competency—presumably, keeping food cold—and writing software is always going to be a sideline.

Just like the computer vendors of the 1990s, IoT manufacturers tout the unbreakability of their systems, deny any problems that are exposed, and threaten legal action against those who expose any problems. The 2017 Abbott Labs patch came a year after the company called the initial report of the security vulnerability— published without details of the attack— “false and misleading.” That might be okay for computer games or word processors, but it is dangerous for cars, medical devices, and airplanes— devices that can kill people if bugs are exploited. But should the researchers have published the details anyway? No one knows what responsible disclosure looks like in this new environment.

Finally, researching vulnerabilities: In order for this ecosystem to work, we need security researchers to find vulnerabilities and improve security, and a law called the Digital Millennium Copyright Act (DMCA) is blocking those efforts. It’s an anti-copying law that includes a prohibition against security research. Technically, the prohibition is against circumventing product features intended to deter unauthorized reproduction of copyrighted works. But the effects are broader than that. Because of the DMCA, it’s against the law to reverse engineer, locate, and publish vulnerabilities in software systems that protect copyright. Since software can be copyrighted, manufacturers have repeatedly used this law to harass and muzzle security researchers who might embarrass them.

One of the first examples of such harassment took place in 2001. The FBI arrested Dmitry Sklyarov at the DefCon hackers conference for giving a presentation describing how to bypass the encryption code in Adobe Acrobat that was designed to prevent people from copying electronic books. Also in 2001, HP used the law to threaten researchers who published security flaws in its Tru64 product. In 2011, Activision used it to shut down the public website of an engineer who had researched the security system in one of its video games. There are many examples like this.

In 2016, the Library of Congress—seriously, that’s who’s in charge of this—added an exemption to the DMCA for security researchers, but it’s a narrow exemption that’s temporary and still leaves a lot of room for harassment.

Other laws are also used to squelch research. In 2008, the Boston MBTA used the Computer Fraud and Abuse Act to block a conference presentation on flaws in its subway fare cards. In 2013, Volkswagen sued security researchers who had found vulnerabilities in its automobile software, preventing them from being disclosed for two years. And in 2016, the Internet security company FireEye obtained a court injunction against publication of the details of FireEye product vulnerabilities that had been discovered by third parties.

The chilling effects are substantial. Lots of security researchers don’t work on finding vulnerabilities, because they might get sued and their results might remain unpublished. If you’re a young academic concerned about tenure, publication, and avoiding lawsuits, it’s just safer not to risk it.

For all of these reasons, the current system of patching is going to be increasingly inadequate as computers become embedded in more and more things. The problem is that we have nothing better to replace it with.

This gets us back to the two paradigms: getting it right the first time, and fixing things quickly when problems arise.

These have parallels in the software development industry. “Waterfall” is the term used for the traditional model for software development: first come the requirements; then the specifications; then the design; then the implementation, testing, and fielding. “Agile” describes the newer model for software development: build a prototype to meet basic customer needs; see how it fails; fix it quickly; update requirements and specifications; repeat again and again. The agile model seems to be a far better way of doing software design and development, and it can incorporate security design requirements, as well as functional design requirements.

You can see the difference in Microsoft Office versus the apps on your smartphone. A new version of Microsoft Office happens once every few years, and it is a major software development effort resulting in many design changes and new features. A new version of an iPhone app might be released every other week, each with minor incremental changes and occasionally a single new feature. Microsoft might use agile development processes internally, but its releases are definitely old- school.

We need to integrate the two paradigms. We don’t have the requisite skill in security engineering to get it right the first time, so we have no choice but to patch quickly. But we also have to figure out how to mitigate the costs of the failures inherent in this paradigm. Because of the inherent complexity of the internet and internet-connected devices, we need both the long-term stability of the waterfall paradigm and the reactive capability of the agile paradigm.

Excerpted from Click Here to Kill Everybody by Bruce Schneier. Copyright © 2018 by Bruce Schneier. With permission of the publisher, W. W. Norton & Company, Inc. All rights reserved.

The Weakest Link is Motherboard's third annual theme week dedicated to the future of hacking and cybersecurity. Follow along.

Listen to Motherboard’s new hacking podcast, CYBER, here.

Henry Farrell is professor of politics and international affairs at George Washington University. Bruce Schneier is a security technologist and the author of fourteen books, including most recently, Click Here to Kill Everybody: Security and Survival in a Hyper-Connected World.

On November 4, 2016, the hacker “Guccifer 2.0,” a front for Russia’s military intelligence service, claimed in a blogpost that the Democrats were likely to use vulnerabilities to hack the presidential elections. On November 9, 2018, President Donald Trump started tweeting about the senatorial elections in Florida and Arizona. Without any evidence whatsoever, he said that Democrats were trying to steal the election through “FRAUD.”

Cybersecurity experts would say that posts like Guccifer 2.0’s are intended to undermine public confidence in voting: a cyber-attack against the US democratic system. Yet Donald Trump’s actions are doing far more damage to democracy. So far, his tweets on the topic have been retweeted over 270,000 times, eroding confidence far more effectively than any foreign influence campaign.

We need new ideas to explain how public statements on the Internet can weaken American democracy. Cybersecurity today is not only about computer systems. It’s also about the ways attackers can use computer systems to manipulate and undermine public expectations about democracy. Not only do we need to rethink attacks against democracy; we also need to rethink the attackers as well.

This is one key reason why we wrote a new research paper which uses ideas from computer security to understand the relationship between democracy and information. These ideas help us understand attacks which destabilize confidence in democratic institutions or debate.

Our research implies that insider attacks from within American politics can be more pernicious than attacks from other countries. They are more sophisticated, employ tools that are harder to defend against, and lead to harsh political tradeoffs. The US can threaten charges or impose sanctions when Russian trolling agencies attack its democratic system. But what punishments can it use when the attacker is the US president?

Authoritarians have weaponized information flows

People who think about cybersecurity build on ideas about confrontations between states during the Cold War. Intellectuals such as Thomas Schelling developed deterrence theory, which explained how the US and USSR could maneuver to limit each other’s options without ever actually going to war. Deterrence theory, and related concepts about the relative ease of attack and defense, seemed to explain the tradeoffs that the US and rival states faced, as they started to use cyber techniques to probe and compromise each others’ information networks.

However, these ideas fail to acknowledge one key differences between the Cold War and today. Nearly all states—whether democratic or authoritarian—are entangled on the Internet. This creates both new tensions and new opportunities. The US assumed that the internet would help spread American liberal values, and that this was a good and uncontroversial thing. Illiberal states like Russia and China feared that Internet freedom was a direct threat to their own systems of rule. Opponents of the regime might use social media and online communication to coordinate among themselves, and appeal to the broader public, perhaps toppling their governments, as happened in Tunisia during the Arab Spring.

This led illiberal states to develop new domestic defenses against open information flows. As scholars like Molly Roberts have shown, states like China and Russia discovered how they could “flood” internet discussion with online nonsense and distraction, making it impossible for their opponents to talk to each other, or even to distinguish between truth and falsehood. These flooding techniques stabilized authoritarian regimes, because they demoralized and confused the regime’s opponents. Libertarians often argue that the best antidote to bad speech is more speech. What Vladimir Putin discovered was that the best antidote to more speech was bad speech.

Russia saw the Arab Spring and efforts to encourage democracy in its neighborhood as direct threats, and began experimenting with counter-offensive techniques. When a Russia-friendly government in Ukraine collapsed due to popular protests, Russia tried to destabilize new, democratic elections by hacking the system through which the election results would be announced. The clear intention was to discredit the election results by announcing fake voting numbers that would throw public discussion into disarray.

This attack on public confidence in election results was thwarted at the last moment. Even so, it provided the model for a new kind of attack. Hackers don’t have to secretly alter people’s votes to affect elections. All they need to do is to damage public confidence that the votes were counted fairly. As researchers have argued, “simply put, the attacker might not care who wins; the losing side believing that the election was stolen from them may be equally, if not more, valuable.”

Flooding and confidence attacks can destabilize democracy

These two kinds of attacks—“flooding” attacks aimed at destabilizing public discourse, and “confidence” attacks aimed at undermining public belief in elections—were weaponized against the US in 2016. Russian social media trolls, hired by the “Internet Research Agency,” flooded online political discussions with rumors and counter-rumors in order to create confusion and political division. Peter Pomerantsev describes how in Russia, “one moment [Putin’s media wizard] Surkov would fund civic forums and human rights NGOs, the next he would quietly support nationalist movements that accuse the NGOs of being tools of the West.” Similarly, Russian trolls tried to get Black Lives Matter protesters and anti-Black Lives Matter protesters to march at the same time and place, to create conflict and the appearance of chaos. Guccifer 2.0’s blog post was surely intended to undermine confidence in the vote, preparing the ground for a wider destabilization campaign after Hillary Clinton won the election. Neither Putin nor anyone else anticipated that Trump would win, ushering in chaos on a vastly greater scale.

We do not know how successful these attacks were. A new book by John Sides, Michael Tesler and Lynn Vavreck suggests that Russian efforts had no measurable long-term consequences. Detailed research on the flow of news articles through social media by Yochai Benker, Robert Farris, and Hal Roberts agrees, showing that Fox News was far more influential in the spread of false news stories than any Russian effort.

However, global adversaries like the Russians aren’t the only actors who can use flooding and confidence attacks. US actors can use just the same techniques. Indeed, they can arguably use them better, since they have a better understanding of US politics, more resources, and are far more difficult for the government to counter without raising First Amendment issues.

For example, when the Federal Communication Commission asked for comments on its proposal to get rid of “net neutrality,” it was flooded by fake comments supporting the proposal. Nearly every real person who commented was in favor of net neutrality, but their arguments were drowned out by a flood of spurious comments purportedly made by identities stolen from porn sites, by people whose names and email addresses had been harvested without their permission, and, in some cases, from dead people. This was done not just to generate fake support for the FCC’s controversial proposal. It was to devalue public comments in general, making the general public’s support for net neutrality politically irrelevant. FCC decision making on issues like net neutrality used to be dominated by industry insiders, and many would like to go back to the old regime.

Trump’s efforts to undermine confidence in the Florida and Arizona votes work on a much larger scale. There are clear short-term benefits to asserting fraud where no fraud exists. This may sway judges or other public officials to make concessions to the Republicans to preserve their legitimacy. Yet they also destabilize American democracy in the long term. If Republicans are convinced that Democrats win by cheating, they will feel that their own manipulation of the system (by purging voter rolls, making voting more difficult and so on) are legitimate, and very probably cheat even more flagrantly in the future. This will trash collective institutions and leave everyone worse off.

It is notable that some Arizonan Republicans—including Martha McSally—have so far stayed firm against pressure from the White House and the Republican National Committee to claim that cheating is happening. They presumably see more long term value from preserving existing institutions than undermining them. Very plausibly, Donald Trump has exactly the opposite incentives. By weakening public confidence in the vote today, he makes it easier to claim fraud and perhaps plunge American politics into chaos if he is defeated in 2020.

Trump’s lies about vote counting are a cybersecurity problem

If experts who see Russian flooding and confidence measures as cyberattacks on US democracy are right, then these attacks are just as dangerous—and perhaps more dangerous—when they are used by domestic actors. The risk is that over time they will destabilize American democracy so that it comes closer to Russia’s managed democracy—where nothing is real any more, and ordinary people feel a mixture of paranoia, helplessness and disgust when they think about politics. Paradoxically, Russian interference is far too ineffectual to get us there—but domestically mounted attacks by all-American political actors might.

To protect against that possibility, we need to start thinking more systematically about the relationship between democracy and information. Our paper provides one way to do this, highlighting the vulnerabilities of democracy against certain kinds of information attack. More generally, we need to build levees against flooding while shoring up public confidence in voting and other public information systems that are necessary to democracy.

The first may require radical changes in how we regulate social media companies. Modernization of government commenting platforms to make them robust against flooding
is only a very minimal first step. Up until very recently, companies like Twitter have won market advantage from bot infestations—even when it couldn’t make a profit, it seemed that user numbers were growing. CEOs like Mark Zuckerberg have begun to worry about democracy, but their worries will likely only go so far. It is difficult to get a man to understand something when his business model depends on not understanding it. Sharp—and legally enforceable—limits on automated accounts are a first step. Radical redesign of networks and of trending indicators so that flooding attacks are less effective may be a second.

The second requires general standards for voting at the federal level, and a constitutional guarantee of the right to vote. Technical experts nearly universally favor robust voting systems that would combine paper records with random post-election auditing, to prevent fraud and secure public confidence in voting. Other steps to ensure proper ballot design, and standardize vote counting and reporting will take more time and discussion—yet the record of other countries show that they are not impossible.

The US is nearly unique among major democracies in the persistent flaws of its election machinery. Yet voting is not the only important form of democratic information. Apparent efforts to deliberately skew the US census against counting undocumented immigrants show the need for a more general audit of the political information systems that we need if democracy is to function properly.

It’s easier to respond to Russian hackers through sanctions, counter-attacks and the like than to domestic political attacks that undermine US democracy. To preserve the basic political freedoms of democracy requires recognizing that these freedoms are sometimes going to be abused by politicians such as Donald Trump. The best that we can do is to minimize the possibilities of abuse up to the point where they encroach on basic freedoms and harden the general institutions that secure democratic information against attacks intended to undermine them.

I have been on Twitter since 2008, accumulating nearly 100 thousand tweets and an inexplicable following of 42 thousand people.

I tweet a lot, and I tweet often. My engagement is high. I drive decent traffic.

I have been called "good at Twitter." I am not sure this is a correct assessment. Jack in the Box sells 554 million tacos a year. This does not make the tacos "good" by any reasonable measure.

I mention these things to establish the fact that I am completely addicted to Twitter. And the new changes to how replies work have made me want to quit entirely.

So I quit cold turkey (okay, fine, cold turkeyish) for a week and replaced it with Mastodon, a decentralized, free and open source software version of Twitter.

Let's be clear: I'm not expecting myself to quit Twitter forever. In fact, I figured that my report back would be something like, "Mastodon: it's weird. Pretty okay though? Anyways, none of my friends are here, so I'm back to the garbage bird site again. Social media services are natural monopolies, shrug!"

But in the middle of writing my first dispatch from my place of exile, Mastodon began to change. It jumped from 23 thousand to 25 thousand to over 30 thousand users. The developer finally met his modest Patreon goal of $800 a month. Graham Linehan (creator of The IT Crowd) and Dan Harmon (creator of Community and Rick and Morty) joined. And the servers finally buckled under all the pressure and I saw my first fail-elephant.

*

This is what mastodon.social looks like: it looks like Tweetdeck before Tweetdeck got too clunky to use.

There's a few key differences. Instead of Twitter's signature 140 character limit—a holdover from SMS—mastodon.social posts have a much more generous cap of 500 characters. This means fewer chained tweetstorms, very little screencapped text, and generally longer and more introspective posts.

The star—the "favourite"—is still here, no cute animated hearts or "likes." A tweet isn't a tweet, it's a toot. (An early financial backer requested that posts be called toots). But a retweet isn't a retoot, it's a boost. None of this lingo really matters, because the icons and buttons are pretty much all the same.

The most interesting deviations from Twitter are privacy settings and the content warning feature.

The content warning (the "cw" button at the bottom) is basically a jump that hides the body of the post. The rules require that you hide pornography and gore with a CW. Some people use the CW to provide trigger warnings for posts about depression, suicide, eating disorders, or sexual assault. Many people even hide political discussion behind a CW, citing that a lot of users are exhausted about hearing about Trump. Other people use the CW simply to reduce clutter: it functions similarly to a "Read more" jump on a blog.

Others use the inherent functionality of the CW to make jokes.

Privacy settings are more flexible than they are on Twitter—privacy is set on a per-post basis, a little similar to how it is on Facebook.

I could make it so all of my posts are private by default, but I don't have to choose between having a public or a private account.

The really interesting nuance here is between "Public" and "Unlisted." An unlisted post is viewable to the public, but it doesn't post to the local or federated timelines.

When I joined, mastodon.social had under 25 thousand users. Now it has 35 thousand. That means there just aren't that many toots being made at any given time. When you open up "local timeline" or "federated timeline" in the third column of the interface, you can see all the public posts being made by all users at any given time.

When I joined, the timeline was clipping away at a steady, but still readable speed. It was entertaining, but not so much of a firehose that it became overwhelming. At some times of the day it slowed down to a downright halt.

At this point you might be wondering what the difference between a "local" and a "federated" timeline is. It's… complicated.

*

If you—like me—are unfamiliar with the landscape of free and open source software (FOSS) social media, Mastodon is weird. It's really really weird. I'm used to apps and services like Facebook, Instagram, Snapchat, and Twitter—companies that took venture capital, are publicly traded on the stock market, and intend to make a return on investment through advertising, and possibly the sale of user information as well.

As the saying goes, if you don't pay for the product, you are the product. When looking solely at these corporate products, social media feels like the hellish extreme of late capitalism, Faustian bargains where consumers consume themselves.

But of course it doesn't have to be that way. And for many years, there's been a small, devoted, and extremely unsuccessful niche of developers and activists trying to get people to adopt various forms of FOSS social media. One example is "GNU social," a software that, in some respects, emulates the functions of Twitter. Mastodon is the most usable version of GNU social so far.

Mastodon has no money, no advertisements, no venture capital—and doesn't plan on getting any. It has no board of directors, no VP of product, no Chief Financial Officer. Peter Thiel will never partly own Mastodon.

Mastodon is pretty much just some dude in Germany with a Patreon goal of $800 a month, to cover "hosting of mastodon.social + my living expenses." When I first made my Mastodon account, his pledges were at about $680. As of writing, he's finally reached his goal, but is still only taking in $967 a month.

It's a small ask, but meeting that threshold is a sign of how far the developer, Eugen Rochko, has come compared to a lot of similar projects. Remember Diaspora? No? Well, that kind of tells you all you need to know about the inevitable fate of most decentralized FOSS alternatives to social media.

The thing is, GNU social isn't just the pipedream of hackerspace denizens. It fills a need and a desire articulated even by people who don't have mohawks or recurring yearly donations to the Free Software Foundation. New York magazine's Max Read wrote in early 2016:

"There should be a 'public option' social network. The open web exists as a public and largely protected space, but it lacks the convenience or centralization of Twitter or other social networks. Let's build one! A public, open, convenient, centralized social network, dedicated to freedom of expression protected by the First Amendment."

Mastodon isn't quite that. But it could be.

*

The thing is, Mastodon isn't just a social network. It's a protocol that can be reimplemented into an infinite number of "instances" maintained by anyone and everyone. But instances aren't segregated and isolated the way chatrooms or Slacks or your group text messages are.

Many of the existing instances are "federated," meaning that members of awoo.space can find me, follow me, and boost and favourite my posts despite the fact that I only have an account on the flagship instance, mastodon.social.

It's a little like how Reddit has subreddits. A redditor can move fluidly between subreddits, and top posts of nearly all the subreddits aggregate to the front page. But where Reddit is actually centralized, with top-down control by administrators across the site, the Mastodon federations are not.

Mastodon.social is run by Eugen "Gargron" Rochko, the developer of the Mastodon protocol, but he doesn't have any say in how awoo.space or icosahedron.website are run. A bannable offense in one instance might be completely acceptable in another.

For now the instances are on friendly terms with each other, coexisting peacefully in federation with each other. Federation isn't as simple as mastodon.social having a treaty with awoo.space. Rather, because one person from awoo.space follows my account, the entirety of awoo.space is now "subscribed" to my posts and can see them in the federated timeline. In order to become visible to awoo.space's federated timeline, someone from awoo.space has to follow you in the first place.

But if mastodon.social and awoo.space had a serious falling-out—which is highly unlikely—the administrators could choose to break ties and blacklist each other. Users from each instance would no longer be able to communicate with each other, unless they made accounts on the other instance.

Max Read calls for a public option social network that protects users based on the First Amendment. Mastodon.social is very much not that. Rochko—who lives in Germany, and is German by nationality—has no allegiance to American constitutional norms.

In fact, mastodon.social bans Nazis. Not even implicitly, but explicitly. The rules of the instance prohibit "content illegal in Germany and/or France, such as holocaust denial or Nazi symbolism" and "conduct promoting the ideology of National Socialism." The instance also bans "racism or advocation of racism," "sexism or advocation of sexism," "discrimination against gender and sexual minorities, or advocation thereof" and "xenophobic and/or violent nationalism." Mastodon.social is definitely not the free speech wing of the free speech party.

But in an increasingly polarized political climate where white nationalists are key advisors in to the US president, banning Nazis is deeply appealing to a lot of people. When asked, users repeatedly cite "Nazis" as a problem they would like Twitter to address. After leaving Twitter, writer Lindy West retorted, "Get back to me when your website isn't a roiling rat-king of Nazis."

Mastodon.social has a better user interface, a non-exploitative financial model, an extremely nice community, and no Nazis. So why isn't mastodon.social winning?

You probably already know the answer. You aren't on Mastodon because your friends aren't on Mastodon. Your friends aren't on Mastodon because you're not on Mastodon. And I wouldn't be on Mastodon, either, if I hadn't promised my editor to write an article about it.

*

My week off Twitter begins with me discovering that I am going to have to set up an elaborate series of hacks to get around the inconveniences of my hiatus. The problem is that Twitter is currently the most reliable way to receive updates on key litigation. But if I stay logged into my account, I'm definitely going to fall into temptation and start tweeting. So instead, I create a dummy account that follows two lawsuit bots and Chris Geidner, the legal editor of Buzzfeed, who tweets a lot of breaking news about Trump-related lawsuits.

Is this cheating? Yes. But I need this to do my work. I'm trying. By God, I'm trying.

I create a Mastodon account on Thursday. By 4PM on Friday I'm completely logged out of Twitter (except for @projectexile420 on my phone). In its place I have Mastodon open in a browser window, and Amaroq—an iOS app for Mastodon—installed on my phone. I have a little initial difficulty setting up Amaroq, because I still don't totally understand the concept of federation. The Amaroq login screen asks me to log into any Mastodon social instance. I try typing in @sarahjeong and get an error.

Eventually I figure out that it wants me to type in the name of the social instance—in my case, mastodon.social—and then log in with my username and password.

Day 1 of Mastodon is very lonely. My home timeline is starting from scratch. I look for funny accounts on the federated timeline, and follow aggressively. I follow back anyone who follows me. I text my friends and try to convince them to join. In a group chat, one friend says, "I thought about it but everyone I know who is an early adopter besides like, you two, totally fucking sucks and posts on Facebook about their latest apple store experience or whatever so i was like basically i'd rather be dead than hang around those perfectly nice people."

It's true that the Mastodon public timelines feature a lot of people tweeting about the latest project they're coding. But the predominant culture of mastodon.social isn't San Francisco techies, it's really more of an LGBTQ-oriented space, one with a lot of anime avatars and a lot of furries. A veritable multitude of anime avatars, but sans Nazis.

On Day 1 of my Twitter exile, mastodon.social strikes me as quiet, gentle, and introspective. There are a lot of CW-hidden posts about depression. Trans users are passing around fundraising links for community members in crisis. One user writes a post about what it was like to be homeless.

Of course, there's shitposting as well. But it's soft in tone. The jokes are funny, but they lack the hard mean edge of Twitter.

When I note that there doesn't seem to be a news reading culture on Mastodon, a user gently suggests that if I post political content, that I should put it behind a CW. This strikes me as overkill, but when in Rome, do as the Romans do.

On the public timelines, one new user comments on how relieved they are to be on a social network where "Buzzfeed" won't be "stealing" their content for clicks. At this point, it seems polite to introduce myself to the Mastodon community, and let them know that a journalist is now hanging out with them. I realize, somewhat to my chagrin, that I will likely have to notify every single user who winds up in my screencaps, and possibly even change screencaps if they object. If I try to defend myself with "But your post was set to public," I will probably be tarred and feathered. But very gently, and possibly with all the tar and feathers behind CWs.

I miss Twitter. I miss it with the intensity of a thousand suns. At 7:25 PM I am hit with the burning desire to search for my latest article on Twitter, and see what people are saying about it. The inherent narcissism of this feeling is embarrassing, and I wish it would go away. It doesn't.

I open and close Twitter on my phone multiple times. Each time, the empty profile of @projectexile420 taunts me for my weakness. When I check the timeline, it's pretty much just Chris Geidner tweeting. I try to calmly gather in whatever news he's breaking at the moment, but I am nearly overcome with the impulse to interact with his tweets.

By 8:49 PM I send Chris a sad Snapchat complaining about my Twitterless existence. He responds with a side-eye emoji. I accept it. I deserve it.

At 9:40 PM I watch as a new user makes a serious faux pas by complaining about mastodon.social's code of conduct.

"I hope nobody is getting too attached to this place. No 'advocation of sexism', I guess that was the world's biggest problem right there, the 'sexism advocates' everywhere with their weird advocacy. For me, there's no way I'm repeating the mistake of allowing 'code of conduct warriors' to control my ability to access a platform I rely upon."

The public timelines immediately explode with subtooting.

"Are people seriously joining here and whinging about the code of conduct," one user writes. "Do you realise why some of us wanted to fuck off from birdsite in the first place?"

"Free Speech™ isn't free folks every awoo $350," toots @eurasierboy. "Every. Awoo."

@Wilkie attempts a serious response. "I'm already seeing people complaining about the *presence* of a code of conduct on this site. Say they might leave, etc. Code of conduct doing its job, I'd say! That's the power of social federation: to create manageable moderated social spaces for everybody without disconnecting a part from the whole. Just go somewhere else."

Mike Masnick of Techdirt—who has only joined Mastodon the other day—remarks, "'Go start your own instance' seems like a pretty useful way to respond to complaints."

The Code of Conduct complainer attempts to fight back by screenshotting one of his subtooting critics and trying to shame them with the retort, "I guess there can never be enough platforms dedicated to social justice."

The public timelines just end up subtooting him some more, until he posts, "Hello, my passive aggressive friends. There have been maybe a couple dozen mean messages directed at me over the last thirty minutes, but nobody ever mentions me by name. Even so, rest assured your point is made, thank you."

For the next hour or so, "Hello, my passive aggressive friends" becomes a meme. I myself sign off for the night with "Good night, my passive aggressive friends." The next day, I sign on again with "Good morning, my passive aggressive friends."

*

I wake up on Saturday to find that I have already tooted over 150 times and I now have 300 followers. Mastodon has also seen a giant spike in sign-ups—or at least, giant by Mastodon standards. Nearly 900 joined mastodon.social on March 31. But the next day, there are another thousand. As of Monday, there have been 10 thousand new user accounts created just in the last week.

Long-time users of Mastodon comment dryly in the public timelines that Twitter must have done something terrible again.

I'm still not used to quitting Twitter, and I keep opening the app on my phone, only to be confronted with an endless backscroll of tweets by Chris Geidner. As much as I love Chris Geidner, this is no replacement for the fast-paced adrenaline rush of content I've curated on my actual account.

I can see on the public timelines that new users are happy that there are no brands, no celebrities, no news junkies on mastodon.social. I am extremely not happy. There is nothing more I'd like to see right at this moment than twenty text-heavy screencaps of the New York Times and a cascade of outraged tweets about the latest Russia scandal.

Is the Merriam-Webster dictionary subtweeting the president today? I wish I knew, so I could pretend to not care.

I am scum and don't deserve mastodon.social. But here I am.

I post an article about Mike Flynn's financial disclosures behind a content warning. I explain in a separate post that I am going to post news links from now on, but out of respect for existing community norms, I will keep Trump-related content behind a CW. Several accounts thank me for it.

My interests and sensibilities aren't well-represented in this community. One of the things I crave the most is the commentary that builds on top of commentary on Twitter. I miss the tweets where people screenshot a pundit's tweet and then place it next to a @dril tweet. Upon further reflection, this is an incredibly stupid thing to miss, and I should be ashamed of myself for letting Twitter take over my life to this extent.

And there's one thing that has to be said about mastodon.social. There are a lot of people complaining about transphobia, homophobia, cissexism, sexism, and Nazis. There are not a lot of people complaining about white supremacy, and there isn't a lot of chatter about the surge of Islamophobia in the world. I understand the need to insulate oneself from upsetting topics, but insulation necessarily breeds insularity.

Not a lot of people on Mastodon use their actual face as an avatar, so I can't make the assumption that Mastodon is extremely, extremely white. But my uncertainty alone feels isolating. On Twitter, many users of color use their avatars or display names to signal that they are an ethnic or religious minority. That social signalling creates clumps of users bound together by preexisting cultural norms and shared concerns. I miss my Twitter feed, and I can't wait to get back.

I still have the greater part of a week left to go. I've garnered over 500 followers (which is a lot in the world of Mastodon) but I still feel isolated and lonely. Part of it, of course, is that only a handful of my friends from Twitter have joined.

Honestly, I am probably a little too mean for mastodon.social. Everyone is nice, but I nonetheless feel like a stranger in a strange land, a complete Twitter jerk stranded in a country of kind-hearted anime avatars. My relief at being on a social network that Julian Assange does not post on is almost perfectly counterbalanced by my regret that I cannot troll him.

But Mastodon's norms aren't set in stone. And mastodon.social is only one instance in a larger federation. There could be an instance with the fast-paced and hard-edged humor I've come to value from Twitter. There could be an instance propagated with news junkies and commentariat. There could be an instance premised on First Amendment principles—the social network that Max Read wants to see exist.

Did you know that for $40 a month, Eugen Rochko will configure and install a Mastodon instance for you?

*

On Sunday, I wake up to find that Graham Linehan and Dan Harmon have joined Mastodon, bringing with them thousands of users. The federated timeline used to flow at a readable pace, now it streams along far too quickly to follow.

Linehan apparently loses interest after finding that the existing community discourages posting publicly about Trump. But the new userbase keeps swelling anyways, and the public timeline is full of people arguing about the future of Mastodon.

"In case anyone is wondering why you can only search hashtags, this was, to a lot of us, a beneficial design decision to counter-act harassment, so that nobody can just do a search for 'otherkin' or 'intersectionality' and then find all the ppl they want to harass, etc. etc," writes one long-time user. They also explain that quote-boost doesn't exist for similar reasons. These features weren't exactly dismissed, but both ended up becoming deprioritized as features to implement because of the disagreement around them.

"So do we ban memes on this website just to be safe or what?" snarks a newer user in a subtoot.

On Monday, the servers are struggling to keep up. Almost 6 thousand users have joined in the last day. I direct message Rochko to ask a few questions for the article—he answers as best he can while working to scale up the servers. It takes several minutes for some of my direct messages to get through, because the servers keep crashing.

In between the crashes, every other toot is a link to someone's long blogpost about Mastodon, or a call for others to donate to Eugen Rochko's Patreon.

35 thousand users is nothing compared to Twitter, and $900 a month is nothing compared to even Twitter's yet-insufficient revenues. But Mastodon doesn't need to kill Twitter, it just needs to survive. And judging by the chatter on the federated timeline, a lot of people have found a home here. Mastodon, I think, is here to stay.